Configuring NodeGraph with SSL/TLS
To enable SSL on your NodeGraph instance, you must first have a certificate to bind to the NodeGraph service port.
Creating a self-signed certificate
If you do not have a root certificate, you can create one for your local machine. These should only be used in verification of your setup, on any Production machine it is recommended to have a root trusted certificate.
> $cert = New-SelfSignedCertificate -certstorelocation cert:
\localmachine\my -dnsname machine.domain.com
> $pwd = ConvertTo-SecureString -String 'PassW0rd' -Force -AsPlainText ## do not use PassW0rd as password
> $path = 'cert:\localmachine\my\' + $cert.thumbprint
> Export-PfxCertificate -cert $path -FilePath C:\temp\localcert.pfx -Password $pwd
You can also print the$cert.thumbprint to screen as you will need this momentarily.
Start by stopping the NodeGraph service.
Run the following command to reserve your NodeGraph port (change 4114 to desired port)
Using Console/Powershell :
URL reservation successfully added
Get the thumbprint from your certificate and bind the certificate to the desired port (make sure to change to your values below).
Using Console/Powershell :
SSL Certificate successfully added
Search “generate GUID” in your Search Engine of choice.
We defer to Microsoft Support on how to achieve this.
Getting the NodeGraph AppId
To get the appID of your NodeGraph installation.
Using Powershell :
"RunspaceId : c85b917f-b2c1-4112-8fbd-a1411dc228a3
Path : %PROGRAMFILES%\NODEGRAPH\NODEGRAPHSERVER.EXE
Publisher :
Hash : SHA256 0x96A4B93EDA58686DB37EDCBC06068176F1336A2E0F183BCC9E2DB8BC472C2C6F
AppX : False
In the located in the NodeGraphServer.exe installation folder, change the following attribute.
If we start the service again, Nodegraph will now operate on HTTPS instead.
You will be met by this page as long as you have a self-signed cert (or until you whitelist the server).
NodeGraph with self-signed SSL/TLS certificate
This is expected and part of the validation process of the trust-chain of certificates (not a NG issue).
Press Advanced > Proceed to <url> (unsafe) to circumvent.
Troubleshooting
I had TLS, but after upgrade my URL wont work?
Your settings are overwritten in the NodeGraphServer.exe.config. See above for restoring these values.
Most browsers today hide the protocol prefix of URLs. Even if you have entered https, the icon in Chrome will not indicate this if there are no services listening on the other side.
It will say secure/insecure (but acknowledging https) if the service is listening.
My settings in NodeGraphServer.exe.config was overwritten, can I find out what I once had?
Yes. If you still have log files of NodeGraph under (default) ProgramData\NodeGraph\logs, you can figure out your settings. In nodegraphsever_YYYY-MM-DD-HH-mm-ss.log , search for
In my logfile, I have the following info
By this, I can deduce i had the following parameters
<add key="Port" value="4141" /> <!-- Corresponds to :4141 -->
<add key="UseTLS" value="true" /> <!-- Corresponds to http/https:// -->